You installed the hotfix. That does not mean you are clean.
Adobe's patch closes the hole. It does not remove a backdoor that was installed before you applied it. StyleSmuggler was exploited in the wild on 4 September, four days before the fix existed.
Answered within five business hours, Mon to Fri, Eastern
4 sept
First confirmed attack, 22:20 UTC
First attack, 22:20 UTC
50 min
From that attack to the first compromised server
To first breach
8 Sept
Added to the CISA KEV catalogue
CISA KEV listed
Free compromise scan
Run by a listed Sansec partner. No cost, no obligation to continue.
Answered within five business hours, Monday to Friday, Eastern. We never ask for credentials by email.
Why the patch is not the end of it
A patch stops the next attacker. It does nothing about the one who already got in. If your store was reachable between 4 and 8 September, patching closed the door behind whoever was already inside.
Patching is not cleaning
Adobe's hotfix removes the vulnerability. It does not remove malware, delete a backdoor, or reverse changes an attacker already made to your files or database.
The implants look like your server
Sansec found payloads posing as fc-cache, chronyd, gvfsd-user and a kernel worker, plus web shells hidden under product image caches. An empty crontab proves nothing.
Eight kinds of credential are exposed
Adobe's guidance is to rotate the encryption key, admin passwords, REST, SOAP and GraphQL tokens, OAuth secrets, payment gateway credentials, database credentials, SSH keys and third-party API keys.
What the free scan actually is
A short call, a forensic scan of your store, and a written finding. Three steps, no charge, and no obligation to buy anything at the end of it.
01
A fifteen minute call
We confirm your version, how long you were exposed, and who does what. You will speak to someone technical, not to a sales queue.
02
eComscan on your store
The forensic scanner built by Sansec, the security firm that discovered StyleSmuggler. We are a listed Sansec partner and we run their tooling, not a lookalike.
03
A written finding
What we found, what it means, and what remediation costs if anything turned up. If the store is clean, we tell you that and you owe us nothing.
What we need from you, before you have to ask
eComscan runs on the server, so the scan needs temporary SSH access to your production environment. That is a real ask, and we would rather put it on this page than spring it on you in the call.
If your store is compromised, any credential created during remediation should be treated as exposed. That shapes how we handle this.
How we take it
A limited user wherever the scan allows it, not root
Shared through a password manager, never by email
Time-boxed, and revoked the moment the scan finishes
Revocation confirmed back to you in writing
A mutual NDA, signed before anything changes hands
Or give us nothing at all
A limited user wherever the scan allows it, not root
Shared through a password manager, never by email
Time-boxed, and revoked the moment the scan finishes
Revocation confirmed back to you in writing
A mutual NDA, signed before anything changes hands
We will walk your own sysadmin through running the scan on a screen share. No credentials change hands, at any point. We read the output with you, live, and you keep the file.
Sansec lists us. That is not a badge we made ourselves.
Sansec is the security firm that discovered StyleSmuggler. Their partner directory describes what we do in their words, not ours: managed Sansec security, eComscan, Shield deployment, alert handling, and malware removal for compromised stores.
StyleSmuggler is the name Sansec gave to CVE-2026-75650, an unauthenticated remote code execution flaw in Adobe Commerce and Magento Open Source. An attacker needs no login to run code on your server.
I applied the patch. Am I safe?
You are safe from new exploitation through this flaw. You are not safe from an implant placed before you patched. Exploitation began on 4 September and the fix shipped on 8 September.
Which versions are affected?
Adobe lists Adobe Commerce 2.4.4 and later, Magento Open Source 2.4.6 and later, and Adobe Commerce B2B 1.3.3 and later. Older unsupported versions are outside Adobe's advisory, which is its own problem.
I am on Magento 2.3. What now?
No vendor patch is coming for an unsupported version, and we do not publish backported patches. We will scan the store and cost out the upgrade that ends the problem instead of deferring it.
Does the scan really cost nothing?
Yes. The call, the scan and the written finding are free. Remediation is quoted separately, after you have seen what was found, and you are free to take that finding to anyone.
Do you need root access?
We ask for the least privilege the scan will run under, and we tell you exactly what that is before you create anything. If you would rather not grant access at all, we guide your own team through it instead.
StyleSmuggler is the name Sansec gave to CVE-2026-75650, an unauthenticated remote code execution flaw in Adobe Commerce and Magento Open Source. An attacker needs no login to run code on your server.
You are safe from new exploitation through this flaw. You are not safe from an implant placed before you patched. Exploitation began on 4 September and the fix shipped on 8 September.
Adobe lists Adobe Commerce 2.4.4 and later, Magento Open Source 2.4.6 and later, and Adobe Commerce B2B 1.3.3 and later. Older unsupported versions are outside Adobe's advisory, which is its own problem.
No vendor patch is coming for an unsupported version, and we do not publish backported patches. We will scan the store and cost out the upgrade that ends the problem instead of deferring it.
Yes. The call, the scan and the written finding are free. Remediation is quoted separately, after you have seen what was found, and you are free to take that finding to anyone.
We ask for the least privilege the scan will run under, and we tell you exactly what that is before you create anything. If you would rather not grant access at all, we guide your own team through it instead.
The window was open for four days. Find out what came through it.
Free scan. Written finding. Answered within five business hours, Monday to Friday, Eastern.
